What should clinics look for in RPM billing compliance software in 2026, given CMS's proposed 2027 changes?

RPM billing compliance software in 2026 has to do more than generate claims. It has to survive an audit. After the OIG's scrutiny of remote patient monitoring billing practices and CMS's CY 2027 proposed rule, which would tighten supervision, time-tracking, and device-supply requirements for RPM and remote therapeutic monitoring (RTM), the software a clinic chooses is now a compliance decision first and a revenue decision second. This guide explains what compliant RPM billing software must actually do in 2026, how the proposed 2027 changes affect your buying decision, and where clinics most often get it wrong.

The Direct Answer: What RPM Billing Compliance Software Must Do in 2026

Also worth reading: How Can AI Healthcare Compliance Metrics Transform Care Coordination for Clinics and Networks? · Can patient pulse consent management scale across clinics without becoming another compliance bottleneck? · Is RPM billing and compliance ready for CMS's tougher 2025 rules?

RPM billing compliance software is a platform that documents, timestamps, and audits every element Medicare requires for CPT codes 99453, 99454, 99457, and 99458 — plus RTM codes 98975 through 98981 — so that a claim can be defended line-by-line during an audit. In 2026, that means the software must capture physician-order linkage, patient consent, device supply and shipment records, per-day time logs attributable to billing practitioners, and evidence of a treatment-management plan tied to a diagnosed condition.

The reason this matters now is timing. CMS's CY 2027 proposed rule, published in mid-2026, proposes sweeping changes in direct response to OIG findings that some RPM vendors billed for patients who never used devices or for time that was never spent. If your software cannot produce contemporaneous records — who reviewed the data, on what date, for how many minutes, under whose supervision — you are building revenue on a foundation that CMS is actively dismantling. The proposed rule also signals that CMS may require the billing practitioner to have an established relationship with the patient and may restrict how device-supply costs are handled, which changes how vendor contracts should be structured.

A clinic evaluating software in September 2026 should treat the 2027 proposed rule as a preview of the final standard. Vendors that only support current 2026 requirements will need retrofit work next year; vendors already building toward the proposed requirements — stricter time attribution, clearer practitioner involvement, and documented patient engagement — will spare you a migration.

Why CMS Is Tightening RPM Rules: The OIG Backdrop

The regulatory shift did not come from nowhere. OIG audits and industry reporting through 2025 and 2026 documented cases where RPM programs billed Medicare for hundreds of patients with minimal clinical engagement — devices shipped and never used, 20-minute time claims with no supporting documentation, and third-party vendors effectively running billing operations with little physician oversight. Telehealth.org and other trade outlets described CMS's posture as openly hostile to vendor-driven RPM models, and law firms including McDermott Will & Schulte, Nixon Peabody, and Wilson Sonsini have all flagged the CY 2027 proposed rule as the most consequential RPM regulatory event since the codes were created.

The practical consequence is that CMS is shifting from trusting attestation to demanding evidence. Under the proposed 2027 framework, expect requirements around direct supervision definitions, the treatment-management-plan linkage, and possibly limits on how much of the required time can be performed by auxiliary personnel. Software that logs everything automatically — device readings received, alerts generated, minutes spent by named staff members — converts an audit from a crisis into a document request.

There is also a clinical dimension worth being honest about: a 2026 study questioning RPM outcomes gave CMS additional cover to tighten billing. Programs that can demonstrate genuine patient engagement — regular readings, documented interventions, measurable clinical changes — will be on the right side of both the audit question and the outcomes question. Programs that exist primarily to generate CPT revenue will not.

The Core Compliance Requirements Your Software Must Track

Any RPM billing platform you evaluate in 2026 should demonstrate, not merely claim, support for these documentation elements. First, an initiating order: the software must link each patient's monitoring episode to a dated physician or qualified practitioner order, with the established-relationship documentation CMS expects. Second, informed patient consent to receive RPM services, stored and retrievable. Third, device management: records of device provision, shipment date, setup education, and confirmation the device meets FDA-defined medical device criteria.

Fourth, and most audit-critical, time tracking. Code 99457 requires at least 20 minutes of interactive communication with the patient or caregiver during a calendar month for treatment and management; 99458 covers each additional 20 minutes. The software must log which staff member spent the time, on what date, doing what — and under the 2027 proposals, that attribution may need to map more strictly to the billing practitioner or directly supervised staff. Software that lets users backfill a month of time in one entry is a liability, not a feature.

Fifth, data review and intervention logs: every reading received, every threshold alert, and every clinical response should be timestamped. Sixth, the treatment-management plan connecting monitoring to at least one diagnosed condition, updated as clinically warranted. Seventh, monthly billing summaries that show 16 or more days of readings within each 30-day cycle for 99454, since that threshold remains the most common reason RPM claims fail audit. A platform that cannot produce a per-patient, per-day compliance report on demand is not compliance software; it is a billing shortcut with an audit trail missing.

Comparing Your Options: Standalone RPM Platforms vs. EHR-Integrated Modules vs. Vendor-Managed Services

Clinics generally choose among three models, and the compliance trade-offs differ more than the marketing suggests. Standalone RPM platforms offer the richest device integrations and alerting but require interfaces or manual reconciliation with your EHR. EHR-native modules keep documentation in one chart but often have weaker device ecosystems and weaker per-minute time logging. Vendor-managed services — where a third party supplies devices, monitoring staff, and billing support — scale fastest but concentrate compliance risk in a contract you do not fully control, which is exactly the model CMS and OIG have criticized.

The comparison table makes the central point visible: the cheapest-looking option is often the vendor-managed model, but it is also the one where you cannot independently verify time logs — and in 2026, unverifiable time logs are the single biggest RPM audit exposure. If you use a vendor-managed service, your contract should guarantee you raw, exportable time and reading data, not just billing summaries.

Practical Steps: Evaluating and Implementing RPM Compliance Software

Start with a documentation gap analysis. Pull ten recent RPM claims and ask whether your current records could answer, in writing, the seven documentation elements above. Most clinics discover within an hour that their time logs are the weak point. That gap becomes your software requirements list.

Next, run a structured demo using your own scenarios rather than vendor scripts. Ask the vendor to show, live, a per-patient audit packet for a hypothetical month: order, consent, device shipment, 18 days of readings, two alert interventions with named staff and minute counts, and the 99457 time log. If any of that requires manual assembly or a support ticket, the software is not audit-ready. Ask specifically how the product plans to handle the CY 2027 proposed requirements — vendors with a written roadmap and a compliance officer on staff are meaningfully different from vendors treating compliance as a marketing word.

Third, verify the billing-engine details. The software should enforce the 16-day reading threshold before allowing a 99454 claim, block duplicate 99457 billing across shared patients, and handle split months when a patient enrolls mid-cycle. Fourth, check the data model: can you export raw time entries and device readings in a machine-readable format you own? If the vendor holds your compliance evidence hostage to their platform, you have a dependency problem, not a software problem.

Finally, phase the rollout. Start with one care team and 25 to 50 patients, run a full month, and internally audit the generated records against the documentation checklist before scaling. Clinics that skip the pilot phase almost always discover configuration problems — unassigned staff, missing consent capture, broken device feeds — after hundreds of claims have already gone out, which converts a software issue into a refund obligation.

Common Mistakes That Turn RPM Software Into an Audit Liability

The most expensive mistake is treating software compliance features as automatic. A platform can log everything and still produce non-compliant claims if staff backfill time, if alerts go unreviewed for weeks, or if the treatment-management plan is a template nobody updates. Software enables compliance; it does not perform it. Assign a named compliance owner, review a random sample of five RPM patient records monthly, and document that review.

The second mistake is billing time that was not interactive. CMS requires that 99457 time involve interactive communication with the patient or caregiver — internal staff huddles about a patient's readings do not count, even though many platforms let users log them. The 2027 proposals would tighten this further, so build the habit now of logging only patient-facing or caregiver-facing minutes.

Third, clinics frequently enroll patients who never engage. If a patient ships a device, takes two readings, and generates zero interactions, the software may still let someone bill 99453 and a partial 99454 — technically defensible in narrow cases, but exactly the pattern OIG flagged. Set an internal engagement floor, such as requiring at least 8 to 10 reading days before any time-based billing, and configure the software to enforce it even though CMS does not.

Fourth, do not let the vendor own the physician relationship. Some vendor-managed arrangements route orders through a vendor-affiliated physician network, which CMS has signaled it may restrict under the 2027 rule. The billing practitioner should have a genuine treatment relationship with the patient, documented in your system. Fifth, ignore the temptation to treat RTM codes as a workaround. RTM (98975–98981) covers non-physiological data such as therapy adherence, and its own documentation rules apply; billing RTM because RPM documentation is incomplete is a distinction CMS auditors understand well.

Costs, Pricing, and the Economics of Compliance-First RPM

Pricing in 2026 falls into three bands. Standalone platforms typically charge $30 to $150 per monitored patient per month, or flat SaaS fees of $500 to $3,000 monthly for a clinic, with device costs of $50 to $200 per patient upfront. EHR-integrated modules are often bundled into existing care-management subscriptions at an effective $10 to $40 per patient per month, though device logistics remain your problem. Vendor-managed services quote $80 to $200 per patient per month all-in, or revenue splits of 20 to 40 percent of collected RPM revenue.

Against that, Medicare reimbursement in 2026 runs roughly $19 to $50 per patient per month for a typical fully-billed RPM episode (99453, 99454, 99457, and one unit of 99458), with 2027 proposed-rule changes expected to adjust both payment and required effort. The margin math only works when enrollment is genuine, engagement is sustained, and billing is clean. A program with 30 percent claim denials or a post-payment audit clawback loses more than it ever earned; OIG-related repayment demands across the industry have run into millions of dollars for the worst actors.

Budget for compliance overhead explicitly: a part-time compliance reviewer, monthly internal audits, and staff training add roughly $2,000 to $5,000 per month for a mid-size program. That is not waste — it is the cost of keeping revenue you have already collected. When comparing vendors, price the audit-export capability and the 2027 readiness roadmap as line items; a platform $20 per patient cheaper that cannot produce contemporaneous time logs is the most expensive option on the table.

When to Act: Timing Your Decision Against the 2027 Final Rule

The CY 2027 Medicare Physician Fee Schedule proposed rule was issued in July 2026, with the comment period closing in early September 2026 and the final rule expected around November 1, 2026, taking effect January 1, 2027. That gives clinics a narrow but real window. If you are selecting RPM billing software now, in September 2026, you should require vendors to state in writing how they will support the proposed 2027 requirements and to commit to a configuration update within 30 days of the final rule's release.

If you already run an RPM program, the right move is a self-audit before January 2027: sample records, verify time logs, confirm consent and order documentation, and correct billing practices that would not survive the proposed standard. Voluntary correction before a payer inquiry is dramatically cheaper than defending claims after one. If you are launching a new program, do not launch on a platform that only meets 2026 rules — you would be buying a migration within six months.

One caveat against panic: proposed rules change. Some 2027 proposals may be softened or delayed in the final rule, and CMS has historically phased in supervision and documentation changes. The correct posture is neither complacency nor overcorrection, but building documentation depth now, since every proposed scenario — stricter time attribution, tighter practitioner involvement, clearer device-supply rules — is satisfied by the same thing: complete, contemporaneous, patient-linked records. Software that produces those records is the right purchase regardless of how the final rule lands.

The Bottom Line for Care Networks and Clinics

RPM billing compliance software in 2026 should be selected the way you would select an audit-defense system, because that is what it has become. The OIG findings and the CY 2027 proposed rule have moved the standard from attestation to evidence, and the vendors that survive that shift will be the ones exporting per-minute, per-staff, per-patient records that a reviewer can verify without your help. Choose a platform that enforces the 16-day threshold, blocks non-interactive time billing, owns nothing of your data, and has a written plan for the 2027 final rule. Then staff the human compliance function the software cannot replace. Programs built that way will keep billing through 2027 and beyond; programs built on vendor convenience and backfilled time logs are already on CMS's list.